Terms of Service

Fresh Cut Boards helps organizations keep compliance work in one place: policies and documents, control libraries (such as SOC 2 and HIPAA), evidence, audit and obligation timelines, and vendor security questionnaires.

The Service is a record-keeping and workflow tool. It does not provide legal, audit, accounting or security advice, and using it does not by itself make you compliant with any law or framework or guarantee that you will pass an audit or obtain a certification. You remain responsible for your own compliance decisions.

The Service is in early access. It may contain errors, and features may be added, changed, interrupted or removed as it develops. We'll give reasonable notice before removing a feature you actively rely on.

• The Service is for business use by people 18 or older. Signing up with a personal email address doesn't make it a consumer service — you're still using it for your organization's compliance work.
• You sign in with a link sent to your email address. Keep your email account secure — anyone who can read it can sign in as you.
• Each organization in the Service is controlled by its Owners and Admins, who decide who may join, which security groups each member belongs to, and whether people with a verified company email domain may join automatically or must request access.
• You may only verify an email domain your organization actually controls, and you are responsible for the access settings you choose.
• You're responsible for activity under your organization's accounts and for removing people who should no longer have access.

You own your data. “Customer Data” means the documents, records, files, answers and other content you or your users (including vendors you invite) put into the Service. We claim no ownership of it.

You give us a limited permission to host, copy, process, transmit and display Customer Data only as needed to provide, secure and support the Service for you, and as described in our Privacy Policy and Data Processing Addendum. We don't sell Customer Data and don't use it to advertise.

You're responsible for having the rights and permissions needed to put Customer Data into the Service — including personal information about your staff and your vendors' contacts — and for its accuracy.

Fresh Cut Boards includes a HIPAA control library to help you organize your HIPAA program, but we do not currently sign Business Associate Agreements. You must not upload, store or send protected health information (as defined under HIPAA) through the Service — for example, patient records in evidence files or questionnaire answers — or other sensitive personal data the Acceptable Use Policy excludes (such as biometric data, full payment card numbers or government ID numbers). Store PHI only in systems covered by a BAA, and reference it from Fresh Cut Boards instead.

If this changes, we'll update these Terms and the Security & Trust page.

When you send a security questionnaire, your vendor receives a private link and can answer without an account. You're responsible for sending questionnaires only to people you have a genuine business relationship with. The portal tells vendors that by saving or submitting answers they agree to the Acceptable Use Policy and to this section; their answers become your Customer Data.

You agree to follow the Acceptable Use Policy. We may suspend access that violates it or that threatens the security, availability or integrity of the Service, and we'll tell you why unless the law or an urgent security need prevents us.

The Service is currently offered without charge. We will give you at least 30 days' notice before introducing fees for features you use, and you can stop using the Service and get an export of your data before any fee applies. Paid plans, when offered, will be described at sign-up or in an order form, which will govern pricing and billing.

The Service — including its software, design, our own control descriptions, questionnaire templates and the Fresh Cut Boards name and medallion logo — belongs to us or our licensors. Third-party framework content (such as AICPA Trust Services Criteria and the HIPAA regulations) belongs to its owners; SOC 2® is a registered mark of the American Institute of Certified Public Accountants, which does not endorse Fresh Cut Boards. You may use the included templates and libraries inside your organization for your own compliance work. You may not copy, resell, reverse engineer or build a competing product from the Service. If you send us feedback, we may use it without obligation to you.

We treat Customer Data as confidential and protect it with the measures described on our Security & Trust page and in the Data Processing Addendum. We give our personnel and subprocessors access only as needed to run the Service. If we learn of a security incident affecting your Customer Data, we'll notify your organization's owners as described in the DPA.

These Terms apply while you use the Service. You may stop at any time, and an owner can ask us to close your organization by writing to support@freshcutboards.com. We may suspend or end your access if you materially breach these Terms and don't fix it within 15 days of notice (or immediately for serious security or legal reasons), or if we discontinue the Service with at least 60 days' notice.

After your organization is closed or its access ends, you have 30 days to ask us (at support@freshcutboards.com) for a full export of your Customer Data in a common format. We then delete it from the live Service, including stored files; database backups expire on their normal rotation (currently within 7 days). Sections that by their nature should survive (such as ownership, disclaimers, liability limits and governing law) survive.

Except as expressly stated in these Terms, the Service is provided “as is” and “as available”. To the fullest extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, title and non-infringement, and any warranty that the Service will be uninterrupted, error-free or that it will achieve any compliance or audit outcome.

To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, even if advised of the possibility. Each party's total liability arising out of or relating to these Terms is limited to the greater of (a) the amounts you paid us for the Service in the 12 months before the claim and (b) one hundred U.S. dollars ($100).

These limits don't apply to your payment obligations, to your indemnity obligations, or where the law doesn't allow them.

You will defend and indemnify us against third-party claims arising from Customer Data you put into the Service or from your violation of these Terms or the Acceptable Use Policy. We will defend and indemnify you against third-party claims that the Service, as we provide it, infringes their intellectual property rights. The party seeking indemnity must give prompt notice and reasonable cooperation.

We may update these Terms. For material changes, we'll give at least 30 days' notice by email to organization owners or in the Service before they take effect. The version and effective date at the top of this page show what applies. Continuing to use the Service after the effective date means you accept the updated Terms.

These Terms are governed by the laws of the State of New Jersey, without regard to its conflict-of-laws rules. The state and federal courts located in New Jersey have exclusive jurisdiction over any dispute arising out of or relating to these Terms or the Service, and both parties consent to that jurisdiction. Before filing a claim, each party agrees to try in good faith to resolve the dispute informally for 30 days.

• These Terms, together with the policies they link to, are the entire agreement about the Service and replace prior discussions.
• If a provision is unenforceable, the rest stays in effect. Not enforcing a provision isn't a waiver.
• You may not assign these Terms without our consent; we may assign them in a merger, acquisition or sale of the business, with notice.
• Neither party is liable for delays caused by events beyond its reasonable control.
• You'll comply with U.S. export control and sanctions laws, and you confirm you're not located in, or acting for anyone in, a sanctioned country or on a U.S. restricted-party list.
• We may send notices to the email addresses of your organization's owners. Send notices to us at legal@freshcutboards.com.